Which versions of ToolJet are affected by CVE-2026-55413?

ToolJet self-hosted instances running versions prior to 3.20.178-lts contain a stored code injection vulnerability in the marketplace plugin system that allows authenticated builder-role users to…. A patch is available.

How to fix or mitigate CVE-2026-55413?

Within 24 hours: Identify all ToolJet self-hosted deployments and verify current versions (Administration > System Settings > Build Version). Immediately restrict builder-role account creation and audit all existing builder-role accounts for suspicious activity or unauthorized plugin modifications. Within 7 days: Restrict builder-role permissions to trusted administrators only; conduct full audit of marketplace plugins and query execution logs for unauthorized changes; enable audit logging if available. Within 30 days: Monitor ToolJet security advisories for patch availability targeting version 3.20.178-lts or later; develop and test upgrade procedures; consider isolating or disabling marketplace plugin functionality on sensitive instances pending patch release.

ToolJet CVE-2026-55413

Q: What is the CVSS score of CVE-2026-55413?

CVE-2026-55413 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39467 CRITICAL

Code Injection (CWE-94)

2026-06-25 GitHub_M

RCE Node.js Code Injection Tooljet

9.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable with a low-privilege free-tier builder account (PR:L), no interaction; injected code crosses from the plugin into the server runtime affecting all users, so Scope:Changed with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:17 vuln.today

DescriptionCVE.org

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any authenticated user with builder role (free tier) can overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executes server-side with full Node.js access (require, process). The malicious code runs whenever any user on the instance triggers a query using that plugin - achieving both RCE and supply-chain compromise of the entire ToolJet deployment. This vulnerability is fixed in 3.20.178-lts.

Articles & Coverage 1

News Critical Stored Code Injection in ToolJet Self-Hosted - CVE-2026-55413 Jun 25, 2026

AnalysisAI

Stored code injection in ToolJet self-hosted (prior to 3.20.178-lts) lets any authenticated builder-role user - available on the free tier - overwrite a globally-shared marketplace plugin with arbitrary JavaScript that runs server-side with full Node.js capabilities (require, process). Because the poisoned plugin executes whenever any user on the instance runs a query that uses it, a single low-privileged account achieves remote code execution and an instance-wide supply-chain compromise. The flaw carries a CVSS 4.0 score of 9.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

ToolJet is an open-source low-code platform for building internal tools, workflows, and AI agents, with a marketplace of plugins that connect to data sources and run query logic. The root cause is CWE-94 (Improper Control of Generation of Code, i.e., code injection): plugin definitions are treated as trusted code and executed in the Node.js server runtime, but the platform fails to isolate plugin source from an attacker or to restrict who may modify a globally-shared plugin. Marketplace plugins appear to run in the main server context rather than a sandbox, so injected code inherits the Node.js process environment, including require (arbitrary module/file access) and process (environment variables, child process spawning). The affected component is the ToolJet application itself (CPE cpe:2.3:a:tooljet:tooljet), and the shared, multi-tenant nature of the plugin store is what converts a single tampered plugin into a path that affects every user and query on the deployment.

RemediationAI

Vendor-released patch: upgrade ToolJet to 3.20.178-lts or later, which fixes the issue (see the advisory at https://github.com/ToolJet/ToolJet/security/advisories/GHSA-jgmf-cw3v-r98x). Until the upgrade is applied, reduce exposure by tightly restricting who can hold the builder role and by limiting account creation so untrusted users cannot reach the plugin-editing capability - note this curtails legitimate self-service app building. Where feasible, restrict or disable the ability to edit or overwrite globally-shared marketplace plugins, audit existing shared plugins for unexpected JavaScript before and after upgrading, and run the ToolJet server with least privilege (non-root container, restricted egress, minimal environment secrets) so that any code execution is contained; the trade-off is added operational friction and potential breakage of plugins that legitimately rely on Node.js modules. After patching, rotate any secrets that were reachable from the server process, since a prior compromise cannot be ruled out.